By allowing Open(at)InRoot to opt-out of the extra work done by MkdirAll
to do the necessary "partial lookups", Open(at)InRoot now does less work
for both implementations (resulting in a many-fold decrease in the number of
operations for openat2, and a modest improvement for non-openat2) and is
far more guaranteed to match the correct openat2(RESOLVE_IN_ROOT)
behaviour.
We now use readlinkat(fd, "") where possible. For Open(at)InRoot this
effectively just means that we no longer risk getting spurious errors during
rename races. However, for our hardened procfs handler, this in theory should
prevent mount attacks from tricking us when doing magic-link readlinks (even
when using the unsafe host /proc handle). Unfortunately Reopen is still
potentially vulnerable to those kinds of somewhat-esoteric attacks.
Several improvements were made to the errors returned by Open(at)InRoot and
MkdirAll when dealing with invalid paths under the emulated (ie.
non-openat2) implementation. Previously, some paths would return the wrong
error (ENOENT when the last component was a non-directory), and other paths
would be returned as though they were acceptable (trailing-slash components
after a non-directory would be ignored by Open(at)InRoot).
These changes were done to match openat2's behaviour and purely is a
consistency fix (most users are going to be using openat2 anyway).
However, it does introduce a new *os.File-based API which is much safer
to use for most usecases. These are adapted from [libpathrs][1] and are
the bare minimum to be able to operate more safely on an untrusted
rootfs where an attacker has write access (something that SecureJoin
cannot protect against). The new APIs are:
OpenInRoot, which resolves a path inside a rootfs and returns an
*os.File handle to the path. Note that the file handle returned by
OpenInRoot is an O_PATH handle, which cannot be used for reading or
writing (as well as some other operations -- see open(2) for more
details).
Reopen, which takes an O_PATH file handle and safely re-opens it to
"upgrade" it to a regular handle.
By allowing Open(at)InRoot to opt-out of the extra work done by MkdirAll
to do the necessary "partial lookups", Open(at)InRoot now does less work
for both implementations (resulting in a many-fold decrease in the number of
operations for openat2, and a modest improvement for non-openat2) and is
far more guaranteed to match the correct openat2(RESOLVE_IN_ROOT)
behaviour.
We now use readlinkat(fd, "") where possible. For Open(at)InRoot this
effectively just means that we no longer risk getting spurious errors during
rename races. However, for our hardened procfs handler, this in theory should
prevent mount attacks from tricking us when doing magic-link readlinks (even
when using the unsafe host /proc handle). Unfortunately Reopen is still
potentially vulnerable to those kinds of somewhat-esoteric attacks.
Several improvements were made to the errors returned by Open(at)InRoot and
MkdirAll when dealing with invalid paths under the emulated (ie.
non-openat2) implementation. Previously, some paths would return the wrong
error (ENOENT when the last component was a non-directory), and other paths
would be returned as though they were acceptable (trailing-slash components
after a non-directory would be ignored by Open(at)InRoot).
These changes were done to match openat2's behaviour and purely is a
consistency fix (most users are going to be using openat2 anyway).
[0.3.0] - 2024-07-11
Added
A new set of *os.File-based APIs have been added. These are adapted from
[libpathrs][] and we strongly suggest using them if possible (as they provide
far more protection against attacks than SecureJoin):
Open(at)InRoot resolves a path inside a rootfs and returns an *os.File
handle to the path. Note that the handle returned is an O_PATH handle,
which cannot be used for reading or writing (as well as some other
operations -- [see open(2) for more details][open.2])
Reopen takes an O_PATH file handle and safely re-opens it to upgrade
it to a regular handle. This can also be used with non-O_PATH handles,
but O_PATH is the most obvious application.
MkdirAll is an implementation of os.MkdirAll that is safe to use to
Add MountedFast by @kolyshkin in moby/sys#100
Note: most users should keep using Mounted, which already incorporates all optimizations from MountedFast
Bumps the go-modules group with 13 updates in the / directory:
1.33.11.34.20.18.70.18.81.0.01.0.11.5.51.5.63.2.13.3.00.12.40.12.61.3.91.4.00.2.50.3.10.0.150.0.160.5.00.6.01.2.21.3.01.6.01.7.02.17.02.19.1Updates
github.com/onsi/gomegafrom 1.33.1 to 1.34.2Release notes
Sourced from github.com/onsi/gomega's releases.
Changelog
Sourced from github.com/onsi/gomega's changelog.
Commits
7cabed6v1.34.2c59c6dcbump ginkgo as well8158b99bump to go 1.22 - remove x/exp dependencyfa057b8v1.34.15e71dcdUse slices from exp/slices to keep golang 1.20 compat32e5498v1.34.0cb3fa6arun go mod tidy and wonder why go get doesnt just run it for me in the first ...8af2ecebump ginkgo878940cfix incorrect handling of nil slices in HaveExactElements (fixes #771)f5bec80clean up bipartitegraph testsUpdates
github.com/paketo-buildpacks/occamfrom 0.18.7 to 0.18.8Release notes
Sourced from github.com/paketo-buildpacks/occam's releases.
Commits
1193f3cBump docker to version 26.1.5 to fix CVE-2024-411105cd4edeUpdates go mod version to 1.23.02e5b930Updates go mod version to 1.22.6815b014Bump github.com/paketo-buildpacks/packit/v2 from 2.14.1 to 2.14.274a79fbBump github.com/paketo-buildpacks/packit/v2 from 2.14.0 to 2.14.190134a5Bump github.com/google/go-containerregistry from 0.20.1 to 0.20.2653a6fbBump github.com/onsi/gomega from 1.34.0 to 1.34.1ed0e429Bump github.com/onsi/gomega from 1.33.1 to 1.34.0f467245Updates go mod version to 1.22.5c97acf2Bump github.com/google/go-containerregistry from 0.20.0 to 0.20.1Updates
github.com/paketo-buildpacks/packit/v2from 2.14.0 to 2.14.2Release notes
Sourced from github.com/paketo-buildpacks/packit/v2's releases.
Commits
3bc586edo not run draft release workflow on branches named v2-<something>d558b87Bump github.com/onsi/gomega from 1.33.1 to 1.34.19f2a7b3Bump github.com/gabriel-vasile/mimetype from 1.4.4 to 1.4.5b117031Updating github-configb6530bcInclude error handling7222905Fix override of existing values in prepend & appende366827Updating github-configa8ac405Bump github.com/gabriel-vasile/mimetype from 1.4.3 to 1.4.44ff7347Bump github.com/BurntSushi/toml from 1.3.2 to 1.4.0Updates
dario.cat/mergofrom 1.0.0 to 1.0.1Release notes
Sourced from dario.cat/mergo's releases.
Commits
59ea6a9Merge pull request #251 from joshkaplinsky/joshkaplinsky/without-dereference-...96f24afMerge pull request #253 from vsemichev/master2f1a615fixes issue #187. adds test to verify the fix.4da170bfixes issue #187. attempt #3a13a117fixes issue #187. attempt #26b830fffixes issue #187f33862aWithoutDereference should respect structscde9f0eMerge pull request #246 from darccio/darccio/v1-frozenf1e2fe5chore: frozen v17f7b4afUpdate FUNDING.ymlUpdates
github.com/DataDog/zstdfrom 1.5.5 to 1.5.6Release notes
Sourced from github.com/DataDog/zstd's releases.
Commits
b52f603Merge pull request #143 from DataDog/viq111/1.5.6cf4778eUpdate Readme for 1.5.6ed87d43Update vendored zstd to 1.5.6dd7b332Merge pull request #136 from colinlyguo/fix-readmebeb4dfdMerge pull request #141 from DataDog/sfluor-patch-1e75a26aUpdate upperBound ratio when guessing the required decompression buffer sizec9a5141fix readme869dae0Merge pull request #132 from DataDog/viq111/bulk-fix-highlycompressed-payloadsbf7b920[bulk] Add extra empty payload decompression test9c0d33f[bulk] Fix namingUpdates
github.com/Masterminds/semver/v3from 3.2.1 to 3.3.0Release notes
Sourced from github.com/Masterminds/semver/v3's releases.
Changelog
Sourced from github.com/Masterminds/semver/v3's changelog.
Commits
e6e3d4dMerge pull request #249 from mattfarina/update-changelog-3.3.0e80c4eaUpdating changelog for 3.3.080427adMerge pull request #248 from mattfarina/bump-min-versionb610837bumping min version in go.mod based on what's testeda4cccd8Merge pull request #246 from mattfarina/bump-go-1.237c178cfUpdating the testing version of Go used29f94c1Merge pull request #241 from grosser/grosser/validate2cf1b16Merge pull request #245 from mattfarina/remove-vertb55476aRemoving reference to vertd07450bsimplify StrictNewVersionUpdates
github.com/Microsoft/hcsshimfrom 0.12.4 to 0.12.6Release notes
Sourced from github.com/Microsoft/hcsshim's releases.
Commits
f922f2aOmnibus dependency updates (#2051)7d25ce2Update module versions85a5a57drop usage of deprecated package/methodsd4b1cc0Bump opa/containerd to latest versions6a5ebd3Upgrade deps to resolve CVEs (#2225)4f46058Omnibus dependency update (#2166)e970943Modifying network flag EnableIov.4f77a09Hcsshim wrapper over HNS API needed for exclusion of management mac addresses...3b5bd8a[release/0.12] vendor: github.com/containerd/containerd v17.1840cdbc8Adding state attribute to the HNSEndpoint struct to support hyperv containers...Updates
github.com/cloudflare/circlfrom 1.3.9 to 1.4.0Release notes
Sourced from github.com/cloudflare/circl's releases.
Commits
c311e46Preparing for release v1.4.062385a8Add ML-KEM decapsulation key check.2b4626dAdd ML-KEM (FIPS 203).d26845feddilithium3: fix typosUpdates
github.com/cyphar/filepath-securejoinfrom 0.2.5 to 0.3.1Release notes
Sourced from github.com/cyphar/filepath-securejoin's releases.
... (truncated)
Changelog
Sourced from github.com/cyphar/filepath-securejoin's changelog.
... (truncated)
Commits
ce7b28aVERSION: release v0.3.1a2c14f8CHANGELOG: add readlinkat(fd, "") shout-out4ea279fmerge #22 into cyphar/filepath-securejoin:main16e1becCHANGELOG: add initial changelog with current history2404ffbmerge #21 into cyphar/filepath-securejoin:mainf29b7a4lookup: handle // and trailing slash components correctlyecd61camerge #19 into cyphar/filepath-securejoin:main38b1220procfs: refactor statx mnt_id logic45c4415procfs: use readlink(fd, "") for magic-linksedab538merge #17 into cyphar/filepath-securejoin:mainUpdates
github.com/docker/clifrom 27.0.2+incompatible to 27.1.1+incompatibleCommits
6312585Merge pull request #5274 from thaJeztah/27.1_backport_compose_oomc599566Allow for OomScoreAdjfb19defMerge pull request #5271 from thaJeztah/27.1_backport_custom_headers_env_varbccd478Merge pull request #5270 from thaJeztah/27.1_backport_test_spring_cleaning8992378add support for DOCKER_CUSTOM_HEADERS env-var (experimental)f90273cMerge pull request #5269 from thaJeztah/27.1_backport_add_macos_apple_siliconca9636atest spring-cleaningad47d2agha: update to macOS 13, add macOS 14 arm64 (Apple Silicon M1)a2a0fb7Merge pull request #5263 from thaJeztah/27.1_backport_relax_pr_check16d6c90Merge pull request #5265 from thaJeztah/27.1_backport_bump_buildx_composeUpdates
github.com/gabriel-vasile/mimetypefrom 1.4.4 to 1.4.5Release notes
Sourced from github.com/gabriel-vasile/mimetype's releases.
Commits
b36b70fremove exe from testdata (#561)e802551Bump the github-actions group across 1 directory with 3 updates (#560)f003e99Bump golang.org/x/net in the gomod group across 1 directory (#552)e0c5c59reduce project size by moving mimetype.gif to testdata (#548)f296c1balias rtf to application/rtf (#547)8329892Updating RTF Magic number to match <https://www.iana.org/assignments/media-ty...3267116remove tarbomb from testdata folder (#540)cdceff9zip: use []byte instead of string to prevent allocs (#537)77e3848tar: remove strconv dependency for tar checksum octal numbers (#536)09ff708json: improve performance by using a pool of scanners (#535)Updates
github.com/google/go-containerregistryfrom 0.19.2 to 0.20.2Release notes
Sourced from github.com/google/go-containerregistry's releases.
Commits
c195f15deps: bump docker dep (#1991)c3d1dccCreateremote.Push(#1978)d36047aRestore blind-write to remote.Put (#1970)9915a85Referrer API must return correct Content-Type (#1968)Updates
github.com/mattn/go-runewidthfrom 0.0.15 to 0.0.16Commits
6ceadc6Support Unicode 15.1.0Updates
github.com/moby/sys/sequentialfrom 0.5.0 to 0.6.0Release notes
Sourced from github.com/moby/sys/sequential's releases.
Commits
Looks like these dependencies are updatable in another way, so this is no longer needed.